Overview
overview
6Static
static
3zapret-win...64.cmd
windows7-x64
1zapret-win...64.cmd
windows10-2004-x64
1zapret-win...et.exe
windows7-x64
zapret-win...et.exe
windows10-2004-x64
zapret-win...ig.exe
windows7-x64
zapret-win...ig.exe
windows10-2004-x64
zapret-win...ck.cmd
windows7-x64
5zapret-win...ck.cmd
windows10-2004-x64
5zapret-win...eck.sh
ubuntu-18.04-amd64
6zapret-win...eck.sh
debian-9-armhf
6zapret-win...eck.sh
debian-9-mips
6zapret-win...eck.sh
debian-9-mipsel
6zapret-win...log.sh
ubuntu-18.04-amd64
3zapret-win...log.sh
debian-9-armhf
3zapret-win...log.sh
debian-9-mips
3zapret-win...log.sh
debian-9-mipsel
3zapret-win...ase.sh
windows7-x64
3zapret-win...ase.sh
windows10-2004-x64
3zapret-win...log.sh
windows7-x64
3zapret-win...log.sh
windows10-2004-x64
3zapret-win...ate.sh
windows7-x64
3zapret-win...ate.sh
windows10-2004-x64
3zapret-win...ype.sh
windows7-x64
3zapret-win...ype.sh
windows10-2004-x64
3zapret-win...irt.sh
windows7-x64
3zapret-win...irt.sh
windows10-2004-x64
3zapret-win...et.exe
windows7-x64
1zapret-win...et.exe
windows10-2004-x64
1zapret-win...ig.exe
windows7-x64
1zapret-win...ig.exe
windows10-2004-x64
1zapret-win...rt.dll
windows7-x64
1zapret-win...rt.dll
windows10-2004-x64
1Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
03-12-2024 16:39
Behavioral task
behavioral1
Sample
zapret-win-bundle-master/arm64/install_arm64.cmd
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
zapret-win-bundle-master/arm64/install_arm64.cmd
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
zapret-win-bundle-master/arm64/ip2net.exe
Resource
win7-20241023-en
Behavioral task
behavioral4
Sample
zapret-win-bundle-master/arm64/ip2net.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
zapret-win-bundle-master/arm64/mdig.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
zapret-win-bundle-master/arm64/mdig.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
zapret-win-bundle-master/blockcheck/blockcheck.cmd
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
zapret-win-bundle-master/blockcheck/blockcheck.cmd
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
zapret-win-bundle-master/blockcheck/zapret/blockcheck.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral10
Sample
zapret-win-bundle-master/blockcheck/zapret/blockcheck.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral11
Sample
zapret-win-bundle-master/blockcheck/zapret/blockcheck.sh
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral12
Sample
zapret-win-bundle-master/blockcheck/zapret/blockcheck.sh
Resource
debian9-mipsel-20240226-en
Behavioral task
behavioral13
Sample
zapret-win-bundle-master/blockcheck/zapret/blog.sh
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral14
Sample
zapret-win-bundle-master/blockcheck/zapret/blog.sh
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral15
Sample
zapret-win-bundle-master/blockcheck/zapret/blog.sh
Resource
debian9-mipsbe-20240611-en
Behavioral task
behavioral16
Sample
zapret-win-bundle-master/blockcheck/zapret/blog.sh
Resource
debian9-mipsel-20240226-en
Behavioral task
behavioral17
Sample
zapret-win-bundle-master/blockcheck/zapret/common/base.sh
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
zapret-win-bundle-master/blockcheck/zapret/common/base.sh
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
zapret-win-bundle-master/blockcheck/zapret/common/dialog.sh
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
zapret-win-bundle-master/blockcheck/zapret/common/dialog.sh
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
zapret-win-bundle-master/blockcheck/zapret/common/elevate.sh
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
zapret-win-bundle-master/blockcheck/zapret/common/elevate.sh
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
zapret-win-bundle-master/blockcheck/zapret/common/fwtype.sh
Resource
win7-20241023-en
Behavioral task
behavioral24
Sample
zapret-win-bundle-master/blockcheck/zapret/common/fwtype.sh
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
zapret-win-bundle-master/blockcheck/zapret/common/virt.sh
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
zapret-win-bundle-master/blockcheck/zapret/common/virt.sh
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
zapret-win-bundle-master/blockcheck/zapret/ip2net/ip2net.exe
Resource
win7-20240729-en
Behavioral task
behavioral28
Sample
zapret-win-bundle-master/blockcheck/zapret/ip2net/ip2net.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
zapret-win-bundle-master/blockcheck/zapret/mdig/mdig.exe
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
zapret-win-bundle-master/blockcheck/zapret/mdig/mdig.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
zapret-win-bundle-master/blockcheck/zapret/nfq/WinDivert.dll
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
zapret-win-bundle-master/blockcheck/zapret/nfq/WinDivert.dll
Resource
win10v2004-20241007-en
General
-
Target
zapret-win-bundle-master/blockcheck/zapret/common/dialog.sh
-
Size
1KB
-
MD5
6fd5b6525dfdd5fdff0a4919fd1a5105
-
SHA1
29dbdca361638b242c8bb36bb4f6b37d34494eae
-
SHA256
ccaf7f160b50060ca3a4044f43c30018c156636c3f4a8ad2e00e60518905a5e9
-
SHA512
92bcdee7f8ca1ab6e3d330e918ced08d3c26d8b192c0f62a95daf3d4994a196509f019ada6f22760941aa18660dbfe39368af3eae81ffcdb3fd6adf379225fee
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings cmd.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings OpenWith.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1188 OpenWith.exe
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\zapret-win-bundle-master\blockcheck\zapret\common\dialog.sh1⤵
- Modifies registry class
PID:220
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1188